Weaknesses of type CWE-862

8,905 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2026-28080MEDIUMWordPress Rank Math SEO PRO plugin <= 3.0.95 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2024-12825MEDIUMCustom Related Posts <= 1.7.3 - Missing Authorization to Authenticated (Subscriber+) Private Post Search and Relation UpdatesEPSS 0.3%CVE-2026-24982MEDIUMWordPress Spectra plugin <= 2.19.17 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-92586MEDIUMAVideo through 29.0 Missing Authorization via comment API endpointEPSS 0.3%CVE-2026-24567MEDIUMWordPress Anything Order by Terms plugin <= 1.4.0 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-4888MEDIUMEverest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder <= 3.4.7 - Missing Authorization to Authenticated (Subscriber+) Email SendingEPSS 0.3%CVE-2026-21836MEDIUMHCL DominoIQ is affected by broken access controlEPSS 0.3%CVE-2026-4058MEDIUMUser Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.3.2 - Missing Authorization to Authenticated (Subscriber+) Subscription Pack CancellationEPSS 0.3%CVE-2025-5033MEDIUMXiaoBingby TeaCMS addUser cross-site request forgeryEPSS 0.3%CVE-2026-44750MEDIUMMissing Authorization check in SAP MDG (Review Match Groups Application)EPSS 0.3%CVE-2024-9187MEDIUMRead more By Adam <= 1.1.8 - Missing Authorization to Authenticated (Subscriber+) Read More Button DeletionEPSS 0.3%CVE-2025-9484MEDIUMMissing Authorization in GitLabEPSS 0.3%CVE-2024-4427MEDIUMComparison Slider <= 1.0.5 - Missing AuthorizationEPSS 0.3%CVE-2025-14351MEDIUMCustom Fonts – Host Your Fonts Locally <= 2.1.16 - Missing Authorization to Unauthenticated Font DeletionEPSS 0.3%CVE-2025-14173MEDIUMPerfit WooCommerce <= 1.0.1 - Missing Authorization to Unauthenticated Arbitrary Plugin Settings DeletionEPSS 0.3%CVE-2026-1054MEDIUMRegistrationMagic <= 6.0.7.4 - Missing Authorization to Unauthenticated Arbitrary Settings ModificationEPSS 0.3%CVE-2026-40134MEDIUMMissing Authorization Check in SAP Incentive and Commission ManagementEPSS 0.3%CVE-2026-9050MEDIUMSlider Revolution 6.0.0-6.7.55 and 7.0.0-7.0.14 - Missing Authorization to Authenticated (Contributor+) Arbitrary Plugin DeactivationEPSS 0.3%CVE-2025-48150MEDIUMWordPress Real Estate Property 2024 Create Your Own Fields and Search Bar WP Plugin plugin <= 4.48 - Broken Access Control VulnerabilityEPSS 0.3%CVE-2025-48282MEDIUMWordPress Majestic Support plugin <= 1.1.0 - Broken Access Control VulnerabilityEPSS 0.3%